Skip to content
CertGPS
Comparison

CISM or the CISSP Associate Route: Passing Before You Have the Years

Both CISM and CISSP let you pass the exam before you have five years. What you hold while you wait, whose experience counts, and which to sit first if you're short.

SC
Sarah Chen
Senior Security Consultant
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CISM or the CISSP Associate Route: Passing Before You Have the Years

What people call "CISSP Associate" is the Associate of ISC2 designation, which you can take after passing the full CISSP exam without the five years of experience. ISACA also lets you sit CISM early, but it hands you nothing to hold until your experience is approved. For someone a few years into security, that difference, and whose work counts toward which five years, should decide the order.

Side by side for a candidate who's short on experience

Associate of ISC2 (CISSP exam)CISM
IssuerISC2ISACA
ExamCISSP: adaptive, 100 to 150 items, 3 hours150 multiple-choice questions, 4 hours
Passing score700 out of 1000, reported as pass or fail450 on a 200 to 800 scale
Price$749 standard registration (Americas)US$575 for ISACA members, US$760 for non-members
What you hold after passing without the experienceThe Associate of ISC2 designationA passed exam; no designation until certified
Time to complete the experienceUp to six yearsFive years from passing to apply
Experience needed for the full credentialFive years in two or more of eight CISSP domains; one year can be waivedFive years in information security management, three across three of four domains; up to two years can be waived
Cost while you wait$50 a year and 15 CPE credits a yearNone until you apply
Upkeep once certified$135 a year and 120 CPE credits per three yearsUS$45 (members) or US$85 a year; 20 CPE hours a year and 120 over three years

What you hold while you wait

The associate designation gives you something to name on a CV the week after you pass, and a structure to keep you current: $50 and 15 CPE credits a year, then an $85 fee difference when you upgrade. The designation has two limits. ISC2's badge says you passed one of its exams without saying which, and you can't call yourself a CISSP until your experience is endorsed. A hiring manager who doesn't know the designation won't infer it.

ISACA has no equivalent for CISM; its associate designation, launched in 2025, covers CISA only. Pass CISM early and you have a score report and five years in which to apply. There's no fee in the meantime and nothing to maintain, but also nothing to put after your name. If the point of sitting early is to show something to an employer now, the ISC2 route does that and the ISACA route doesn't.

Whose experience counts toward which five years

This is where the two diverge most. CISSP counts five years in any two of its eight domains, which run from asset security and network security to software development. Most full-time security jobs fill at least one domain from day one, and an analyst who also handles access reviews or vulnerability assessments is covering two.

CISM counts information security management only, within the ten years before you apply, and at least three years must cover three of ISACA's four areas: governance, risk management, the security program, and incident management. Up to two years of general information security work can fill the rest. Someone three years into an analyst role may be well on the way to CISSP and still at zero management years for CISM.

So for an analyst who is short on experience, the associate route usually ends sooner. ISC2's six-year window starts at a point where your current job is probably already counting.

Waivers that don't carry over, and a date to watch

The two credentials waive time off each other, but an associate gets less from that than you'd hope. ISACA lets a current CISSP in good standing count for two of CISM's five years. An Associate of ISC2 isn't a CISSP, so the designation earns no CISM waiver. In the other direction, CISM is on ISC2's list of credentials that waive one CISSP year. An associate who earns CISM along the way can use it toward the CISSP upgrade, though by then the management years usually cover CISSP's requirement anyway.

Both exams test the manager's answer more than the technician's. CISSP spends 16% on security and risk management and ranges across all eight domains; CISM goes deeper into running a program, with a third of the exam on the program domain and 30% on incident management. Note the date: CISM moves to a new outline on November 3, 2026, with more weight on strategy and program development, so a candidate sitting this winter should buy the 2026 materials.

Our view

If you're two to four years into security work and ready for an exam now, we'd sit CISSP and take the associate route first. Your current work probably counts toward its five years, the designation gives you something to show, and once you're a full CISSP it's worth two years toward CISM. Sit CISM when you hold a management role, not before; passing it with no management years leaves you waiting with nothing to show for it. A reader already in management, with the ISACA years close, should reverse that order. Our CISSP and CISM comparison covers the fully qualified version of this choice, and SSCP against the associate route covers a shorter path to a full credential.

Sources